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r_T, ATM AMENDMENTS 

1-52 (Cancelled) 

53. (Currently Amended) A method of managing network traffic 
being routed through a network connection device, the network 
connection device having a first in struction set, the network traffic 
being composed of at least first and second traffic flows, each 
traffic flow being composed of at least one data packet, and the 

method comprising: 

(a) instantiating a virtual machine on the network connection 
device, the virtual machine having a second i nstruction set, the 
second instruction set being a sub-set of the first instruction set, 

(b) receiving at least a first criterion at the network 
connection device for identifying the traffic flow to which a data 
packet belongs, 

(b) ( C ) receiving at least- a second criterion at the network 
connection device for classifying a traffic flow as belonging to one 
of at least first and second traffic flow classes, 

(o) _ ^d) receiving first and second instructions at the network 
connection device for processing a data packet, the first and second 
instructions being associated with the first and second flow classes 
respectively, 

±©L storing the first and second criteria and the first and 
second instructions on the network connection device, 

-fef JJJ_ receiving a first data packet that belongs to the first 
traffic flow at the network connection device, 

+£4- (a) using the first criterion to determine that the first 
data packet belongs to the first traffic flow, 

(g) (hj_ using the second criterion to determine the traffic flow 
class to which the first traffic flow belongs, and 

jj) processing the first data packet according to the 
instructions associated with the flow class to which the first traffic 
flow bclongo * belongs, 

wherein steps (b) through (i) are m anaged bv the virtual machine. 

54. (Currently Amended) The method of claim 53, wherein steps 
[a), (b) and (c)- ITo) . (c) and (d) comprise receiving a pre -compiled 
file containing the first and second criteria and first and second 
instructions . 
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55. (Currently Amended) The method of claim 53, wherein atop — {£± 
step (a) comprises comparing a first section of the first data packet 
to the first criterion to determine that the first data packet belongs, 
to the first traffic flow, and otcp (g) - step (h) comprises comparing a 
second section of the first data packet to the second criterion to 
determine the traffic flow class to which the first traffic flow 
belongs, the second section being non-exclusive of the first section. 

56. (Currently Amended) The method of claim 53, further 
comprising the step of receiving supplemental data pertaining to the 
first traffic flow, wherein the supplemental data is received outside 
of the first traffic flow and otcp (g) step (h) further comprises 
comparing the supplemental data to the second criterion to determine 
the class to which the first traffic flow belongs. 

57. (Previously Presented) The method of claim 56, wherein the 
supplemental data comprises data concerning network access rights of a 
user of the network, a traffic flow belonging to a user having a first 
level of network access rights being classified as belonging to the 
first traffic flow class, and a traffic flow belonging to a user 
having a second level of network access rights being classified as 
belonging to the second traffic flow class. 

58. (Previously presented) The method of claim 57, wherein the 
first and second instructions specify respective first and second 
bandwidth allocations. 

59. (Previously Presented) The method of claim 56, wherein the 
supplemental data comprises data concerning network access 
requirements ot a network device and the first traffic flow originates 
at the network device . 

60. (Previously Presented) The method of claim 59, wherein the 
network access requirements of the network device are based on network 
acceya requirements of a client application executing on the network 
device . 
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61. (Previously Presented) The method of claim 56, wherein the 
supplemental data comprisee data concerning network traffic conditions 
at a network device and the first traffic flow originates at the 
network device . 

62. (Previously Presented) The method of claim 56 , wherein the 
supplemental data is received from a registry within which data 
pertaining to multiple network devices is stored. 

63. (previously Presented) The method of claim 56, wherein the 
supplemental data identifies a work group to which a network device 
belongs and the first traffic flow originates at the network device. 

64. (Previously Presented) The method of claim 56, wherein the 
supplemental data identifies a physical characteristic of a network 
device belongs and the first traffic flow originates at the network 
device . 

65. (Previously Presented) The method of claim 56, wherein the 
supplemental data comprises data concerning network access 
requirements of a network device and the first traffic flow is being 
transmitted to the network device. 

66. (Previously Presented) The method of claim, 65 wherein the 
network access requirements of the network device are based on network 
access requirements of a client application executing on the network 
device . 

67. (Previously Presented) The method of claim 56, wherein the 
supplemental data comprises data concerning network traffic conditions 
at a network device and the first traffic flow ia being transmitted to 
the network device. 

68. (Previously Presented) The method of claim, 56 wherein the 
supplemental data identifies a work group to which a network device 
belongs and the first traffic flow is being transmitted to the network 
device , 
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69. (Previously Presented) The method of claim 56, wherein the 
supplemental data identifies a physical characteristic of a network, 
device belongs and the first traffic flow is being transmitted to the 
network device . 

70. (Previously Presented) The method of claim 56 , wherein the 
supplemental data pertains to a context of receipt of a second data 
packet belonging to the first traffic flow at a network device. 

71- (Previously Presented) The method of claim 70, wherein the 
supplemental data includes a time of day at which the second data 
packet was received at the network device. 

72. (Previously Presented) The method of claim 53, wherein the 
first and second instructions pertain to any one of routing, switching 
or bridging the network traffic. 

73. (Previously Presented) The method of claim 53, wherein the 
first traffic flow originated at a network device and the method 
further comprises the step of communicating information regarding the 
first data packet to the network device. 

74. (Previously Presented) The method of claim 53, wherein at 
least one of the first and second criteria and the first and second 
instructions are provided by a network administrator. 

75. (Cancelled) 

76. (Currently Amended) The method of claim 7 S claim 53, wherein 
steps — (o) and (d) (r.) . (d) and (e) comprise receiving a 
pre-compiled file containing the first and second criteria and first 
and second instructions and the pre-compiled file is based on the 
second instruction set. 

77. (Currently Amended) A method of operating a network 
connection device, the network connection device having a fir si; 
instruction set, a data ingress for receiving network traffic, a data 
egress for transmitting network traffic, and having at least a first 

5 
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criterion, a second criterion and first and second instructions stored 
therein, the first and second instructions being associated with 
respective first and second traffic flow classes, the network traffic 
being composed of at least first and second traffic flows, each 
traffic flow being composed of at least one data packet, and the 
method comprising: 

(a) instantiating a virtual machine on the ne twork connection 
device, the virtual machine having a se cond instruction set, the 
second instruction g »t-. frying a sub-set of the first instruction set, , 

4t*f ibl receiving a first data packet that belongs to the first 
traffic flow at the ingress of the network connection device, 

-tW- Jcl using the first criterion to determine that the first 
data packet belongs to the first traffic flow, 

4e4- (d) using the second criterion to determine a traffic flow 
class to which the first traffic flow belongs, 

(d) <e) processing the first data packet according to the 
instructions associated with the flow class to which the first traffic 
flow belongs, and 

(d) (f ) transmitting the first data packet from the egress 
according to the instructions associated with the flow class to which 
the first traffic flow bolongo . belongs, 

wh^rfiin steoB (b) through (f) are managed bv the virtual 

machine^ 

78. (Currently Amended) The method of claim 77, further 
comprising, prior to step (a) step (b) the step of receiving a 
pre-compiled file containing the first and second criteria and first 
and second instructions. 

79. (Currently Amended) The method of claim 77, wherein step (b) 
steo (c) comprises comparing a first section of the first data packet 
to the first criterion to determine that the first data packet belongs 
to the first traffic flow, and atop (c) step (d) comprises comparing a 
second section of the first data packet to the second criterion to 
determine the traffic flow class to which the first traffic flow 
belongs, the second section being non-exclusive of the first section. 
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80. (Currently Amended) The method of claim 77, further 
comprising the step of receiving supplemental data pertaining to the 
first traffic flow, wherein the supplemental data is received outside 
of the first traffic flow and o tcp <o) flteo (d) further comprises 
comparing the supplemental data to the second criterion to determine 
the class to which the first traffic flow belongs. 

81. (Previously Presented) The method of claim SO, wherein the 
supplemental data comprises data concerning network access rights of a 
user of the network, a traffic flow belonging to a user having a first 
level of network access rights being classified as belonging to the 
first traffic ±low class, and a traffic flow belonging to a user 
having a second level of network access rights being classified as 
belonging to the second traffic flow class. 

82. (Previously Presented) The method of claim 81, wherein the 
firsL and second instructions specify respective first and second 
bandwidth allocations. 

83. (Previously Presented) The method of claim 80, wherein the 
supplemental data comprises data concerning network access 
requirements of a network device and the first traffic flow originates 
at the network device . 

84. (Previously Presented) The method of claim S3 wherein the 
network access requirements of the network device are based on network 
access requirements of a client application executing on the network 
device . 

85. (Previously Presented) The method of claim 80, wherein the 
supplemental data comprises data concerning network traffic conditions 
at a network device and the first traffic flow originates at the 
network device. 

86. {Previously Presented) The method of claim 80, wherein the 
supplemental data is received from a registry within which data 
pertaining to multiple network devices is stored. 
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87, (Previously Presented) The method of claim 80, wherein the 
supplemental data identifies a work group to which a network device 
belongs and the first traffic flow originates at the network device. 

B8. (Previously Presented) The method of claim 80, wherein the 
supplemental data identifies a physical characteristic of a network 
device belongs and the first traffic flow originates at the network 
device. 

89. (Previously Presented) The method of claim 80 , wherein the 
supplemental data comprises data concerning network access 
requirements of a network device and the first traffic flow is being 
transmitted to the network device. 

90. (previously Presented) The method of claim 89, wherein the 
network access requirements of the network device are based on network 
access requirements of a client application executing on the network 
device . 

91. (Previously Presented) The method of claim 80, wherein the 
supplemental data comprises data concerning network traffic conditions 
at a network device and the first traffic flow is being transmitted to 
the network device. 

92. (Previously Presented) The method of claim 80 r wherein the 
supplemental data identifies a work group to which a network device 
belongs and the first traffic flow is being transmitted to the network 
device, 

93. (Previously Presented) The method of claim 80, wherein the 
supplemental data identifies a physical characteristic of a network 
device belongs and the first traffic flow is being transmitted to the 
network device. 

94. (Previously Presented) The method of claim 80, wherein the 
supplemental data pertains to a context of receipt of a second data 
packet belonging to the first traffic flow at a network device. 
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95. (Previously Presented) The method of claim 94, wherein the 
supplemental data includes a time of day at which the second data 
packet was received at the network device. 

96. (Previously Presented) The method of claim 77, wherein the 
first and second instructions pertain to any one of routing, switching 
or bridging the network traffic, 

97. (Previously Presented) The method of claim 77, wherein the 
first traffic flow originated at a network device and the method 
further comprises the step of communicating information regarding the 
first data packet to the network device. 

98. (Previously Presented) The method of claim 77, wherein at 
least one of the first and second criteria and the first and second 
instructions are provided by a network administrator. 

99- (Cancelled) 

100. (Currently Amended) The method of elaim 99 claim 77, wherein 
the method comprises, prior to step — k*f step (b) , receiving a 
pre- compiled file containing the first and second criteria and first 
and second instructions and the pre-compiled file is based on the 
second instruction set. 
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